Speeding-Up Verification of Digital Signatures Abdul Rahman Taleb, Damien Vergnaud To cite this version: Abdul Rahman Taleb, Damien Vergnaud. Speeding-Up Verification of Digital Signatures. Journal of Computer and System Sciences, Elsevier, 2021, 116, pp.22-39. 10.1016/j.jcss.2020.08.005. hal- 02934136 HAL Id: hal-02934136 https://hal.archives-ouvertes.fr/hal-02934136 Submitted on 27 Sep 2020 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Speeding-Up Verification of Digital Signatures Abdul Rahman Taleb1, Damien Vergnaud2, Abstract In 2003, Fischlin introduced the concept of progressive verification in cryptog- raphy to relate the error probability of a cryptographic verification procedure to its running time. It ensures that the verifier confidence in the validity of a verification procedure grows with the work it invests in the computation. Le, Kelkar and Kate recently revisited this approach for digital signatures and pro- posed a similar framework under the name of flexible signatures. We propose efficient probabilistic verification procedures for popular signature schemes in which the error probability of a verifier decreases exponentially with the ver- ifier running time. We propose theoretical schemes for the RSA and ECDSA signatures based on some elegant idea proposed by Bernstein in 2000 and some additional tricks. We also present a general practical method, that makes use of efficient error-correcting codes, for signature schemes for which verification involves a matrix/vector multiplication. Keywords: Public-Key Cryptography, Digital Signatures, Probabilistic Verification, RSA Signatures, ECDSA Signatures, GPV Signatures 1. Introduction It is common in public-key cryptography, that parties need to repeatedly verify equations that ensure the validity of some input (e.g. for digital signa- ture schemes, commitment schemes, or proof systems). In 2003, Fischlin [21] introduced the idea of progressive verification in cryptography to relate the er- ror probability of a verification procedure to its running time. This concept overcomes the property that a verifier remains oblivious about the validity of a verification procedure until it is actually completed. Fischlin’s approach ensures that the verifier confidence grows with the work it invests in the computation. Digital signatures are arguably the most important cryptographic primi- tive and fast signature verification is extremely desirable in many applications (especially for numerous low computation scenarios such as RFID, wireless sen- sors or smart cards). Therefore, as explicitly mentioned in Fischlin’s work, Email addresses: [email protected] (Abdul Rahman Taleb), [email protected] (Damien Vergnaud) 1Sorbonne Université, CNRS, LIP6, Paris, France and CryptoExperts 2Sorbonne Université, CNRS, LIP6, Paris, France and Institut Universitaire de France Preprint submitted to Elsevier September 24, 2020 it is interesting to find non-trivial signature schemes in which the underlying number-theoretic function is somewhat progressively verifiable. In a digital sig- nature protocol with progressive verification, the goal is to design a probabilistic verification procedure (in addition to the classical deterministic verification al- gorithm) that takes as input a message m, a public-key vk, a putative digital signature σ on m for vk, and a timing parameter τ and outputs some real number α 2 [0; 1] (or the special symbol ? if σ is detected as invalid). The pro- gressive verification algorithm never rejects valid signatures and α represents its confidence level on the signature validity. This algorithm can be seen as a probabilistic method to spot flawed signatures faster than using the classical deterministic verification algorithm. The progressive verification procedure is sound if it accepts any invalid signature with probability at most α (over the random choices of the verification procedure). Recently, Le, Kelkar and Kate recently revisited Fischlin’s concept for digital signatures (under the name of flexible signatures) [41]. They presented a progressive probabilistic verification for the classical one-time signatures of Lamport. The goal of this paper is to present efficient and secure progressive verification procedures for popular sig- nature schemes (including RSA, ECDSA and GPV signature schemes). 1.1. Prior Work Digital signatures are a cryptographic mechanism used to verify the authen- ticity and integrity of digital data. They allow a signer who has established a public verification key to sign a message such that any other party can ver- ify that the message originated from the signer and was not modified in any way. This primitive is of paramount importance for building secure systems and are used in most real-world security protocols. However, for most signa- ture schemes, many computation devices with limited computation power are not able to perform signature verification which is both time and power con- suming. Many techniques have been suggested over the years to decrease the computational overhead of signature verification. A lot of work in cryptography has been devoted to design schemes allowing to perform expensive tasks in batch rather than individually to achieve better ef- ficiency. For instance, in order to speed up the verification of several signatures, Bellare, Garay and Rabin [4] proposed batch verification to securely verify a set of digital signatures. For the verification of individual signatures, the concept of server-aided verification was proposed by Quisquater and de Soete [45] for speeding up RSA verification with a small exponent. Protocols for signature schemes were subsequently proposed and Girault and Lefranc formalized the concept in [29]. This paradigm allows signatures to be verified by executing an interactive protocol with an untrusted server which requires less computation than the original verification algorithm of the digital signature. For all these verification procedures, a verifier performs a certain number of verification steps and finally outputs a decision; the error probability of this decision is usually null or at most negligible. However, if a verification algo- rithm is stopped after some computation steps but before its end, the algorithm usually cannot predict the result better than before the start of computation. 2 error error error probability probability probability time time time all-or-nothing linear progressive progressive verification verification verification Figure 1: Principle of Progressive Verification In [21], Fischlin called this all-or-nothing verification: in order to give a reliable decision one must run the full verification procedure (see Figure 1, left part). Fischlin introduced the idea of progressive verification with the goal to relate the error probability of the decision to the running time of the verifier. As shown in Figure 1 (right part), one wants the error probability of the verifier’s decision to decrease quickly with the number of performed steps of the verifi- cation procedure. Fischlin focused on message authentication codes in [21] and hash chains in [22] and left open the problem of designing signature schemes in which the underlying number-theoretic function is progressively verifiable. As mentioned above, Le, Kelkar and Kate [41] showed that the classical one-time Lamport signature scheme [40] is suitable for progressive verification in which the error probability of the verifier’s decision decrease linearly with the number of performed steps of the verification procedure. Indeed, in this signature scheme, a verifier validates a signature by checking whether k (inde- pendent) equations hold (where k is the length of the signed message), and the progressive verification procedure consists in checking each equation in a ran- dom order. In the following, we will use the term linear progressive verification for such schemes that run atomic verification of independent computation in a random order and for which the error probability thus decreases linearly with its number of sequential executions (see Figure 1, middle part). They also pro- posed a (linear) progressive verification scheme for Merkle tree signatures [43]. This idea of using intermediate values of the computation has also been used in the context of verification of hash chains before (see e.g. [34, 35, 36, 37] and references therein). Many identification protocols proceeds in sequential rounds such that in each round a cheating prover will be caught with some small probability, say, 1=2 or 2=3 (e.g. [19] in factoring-based cryptography, [49, 50] in code-based cryptog- raphy, [39] in lattice-based cryptography or [46] in multivariate cryptography). Repeating the protocol permits to reduce the soundness error of these iden- tification systems. Fischlin already noted in [21] that using the Fiat-Shamir heuristic [20], we obtain digital signature schemes suitable for linear progressive verification. These resulting signature schemes are often less efficient (in compu- tational complexity or communication complexity) than other schemes based on 3 similar assumptions, but which do not